Users & Access
Filipe Dos Santos, RF Super Admin. 9 of 9 sites are visible to this account.
Access matrix
8 users × 9 sites across 3 client organisations
| Organisation | Redefine Properties | Tsogo Sun | Bounty Foods | Scope | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| User | RIV | ALN | SGT | GWY | RAD | MTC | CL4 | BFM | NSP | Sites |
Filipe Dos SantosYou RF Super Admin | 9/9 | |||||||||
Sipho Ndlovu RF Technical Admin | 9/9 | |||||||||
Johan van Wyk RF Technician | 3/9 | |||||||||
Thandi Mokoena Client Portfolio Manager | 3/9 | |||||||||
John Peters Building / Site Manager | 1/9 | |||||||||
Ayesha Patel Building / Site Manager | 1/9 | |||||||||
Dirk Coetzee Client Portfolio Manager | 3/9 | |||||||||
Kagiso Sithole Contractor / Read Only | 1/9 | |||||||||
This matrix is rendered from the same membership records that generate the PostgreSQL row-level security policies. The interface cannot show a cell the database would not return.
Direct API probe
The section 18 test: a user from one tenant attempting to retrieve another tenant’s data
Filtering in the interface proves nothing — anyone can open developer tools and call the API directly. So this issues the request the way an attacker would: a valid session token for the signed-in user, pointed at a site identifier they were never granted.
GET /rest/v1/events?site_id=eq.site-rivonia&select=*
Host: firecare-prod.supabase.co
Authorization: Bearer eyJhbGciOiJIUzI1NiIs… (filipe@rfsystems.co.za)
apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9… (anon)
Accept: application/json
Prefer: count=exactDecoded claims
sub: u-rf-admin
email: filipe@rfsystems.co.za
role: authenticated · aal: aal2 (MFA)
All 9 sites are listed, including the ones outside your scope. Site identifiers are not secrets — the defence cannot depend on the attacker not knowing them.
The policy behind it
alter table events enable row level security;
alter table events force row level security;
create policy events_tenant_read on events for select
using (
site_id in (
select site_id from user_site_access
where user_id = auth.uid()
)
);force row level security matters — without it the table owner bypasses every policy.
Roles & permissions
6 defined roles — permissions are attached to the role, never to the individual
| Role | Typical access | In view | MFA required |
|---|---|---|---|
RF Super Admin rf_super_admin Your role | Full platform administration across every tenant: organisation and site creation, licencing, user provisioning and role assignment. Reads all data; every action is written to the audit trail. | 1 | Required |
RF Technical Admin rf_technical_admin | Gateway commissioning, point-to-asset mapping, rule and threshold configuration, firmware and SIM management across all client sites. No tenant creation, no billing. | 1 | Required |
RF Technician rf_technician | Field operative, restricted to assigned sites. Executes inspections, scans asset QR codes, captures test results and closes defects. Cannot alter rules, scopes or user access. | 1 | Required |
Client Portfolio Manager client_portfolio_manager | Read and report across every site in their own organisation. Acknowledges events, approves quotations and exports compliance packs. No configuration rights on any system. | 2 | Required |
Building / Site Manager site_manager | One building. Receives life-safety notifications, acknowledges events, logs impairments and views the asset register and inspection history for that site only. | 2 | Optional |
Contractor / Read Only contractor_readonly | Time-boxed read-only view of the sites they are contracted to. Sees asset registers, inspection history and defect status. No acknowledgement, no portfolio-wide export. | 1 | Optional |
Multi-factor authentication is mandatory for every RF operations role and for client portfolio managers, because those accounts can read across more than one building. Site managers and contractors may enrol voluntarily; enrolment state is recognised in the JWT as the assurance level shown in the probe above.
Users
8 accounts across 4 organisations
| Name | Organisation | Role | Site scope | MFA | |
|---|---|---|---|---|---|
FDFilipe Dos SantosYou | filipe@rfsystems.co.za | RF Monitoring Systems | RF Super Admin | All sites, all organisations(9) | Enrolled |
SNSipho Ndlovu | sipho@rfsystems.co.za | RF Monitoring Systems | RF Technical Admin | All sites, all organisations(9) | Enrolled |
JvJohan van Wyk | johan@rfsystems.co.za | RF Monitoring Systems | RF Technician | 90 Rivonia, 15 Alice Lane, Clayville C4(3) | Enrolled |
TMThandi Mokoena | thandi@redefine.co.za | Redefine Properties | Client Portfolio Manager | 90 Rivonia, 15 Alice Lane, Sandton Gate(3) | Enrolled |
JPJohn Peters | john.peters@redefine.co.za | Redefine Properties | Building / Site Manager | 90 Rivonia(1) | Not enrolled |
APAyesha Patel | ayesha@tsogosun.com | Tsogo Sun | Building / Site Manager | Gateway Theatre(1) | Not enrolled |
DCDirk Coetzee | dirk@bountyfoods.co.za | Bounty Foods | Client Portfolio Manager | Clayville C4, Bounty Foods Midrand, Nelspruit Office(3) | Enrolled |
KSKagiso Sithole | kagiso@acmefire.co.za | Redefine Properties | Contractor / Read Only | 15 Alice Lane(1) | Not enrolled |
Audit trail
Loading chain
Each entry commits to the hash of the one before it. Deleting or editing a historical entry breaks the chain and is detectable.